4b3b65e8d52f092f3c00fe15dc17667b00846a13af082286f3ba2e5c42d9497d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 01:14

Target

2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe
Size

989KB
MD5

2e7e9626c5bf7a7d9414e99cdf6e6ff9
SHA1

5c5e1454ca5242610efa5e2035c798946d67148c
SHA256

4b3b65e8d52f092f3c00fe15dc17667b00846a13af082286f3ba2e5c42d9497d
SHA512

6de838e353bf5879e5b87b71675d3bb79cc1ab1c0458affcb6d71f99b745b1dea28859323cba0fb5f87c5879bb78f76ae74c36df10a23cba6fd2a4e215296ce1
SSDEEP

6144:Qtug8L/GGVGGpoGGtGGG0GG9GGG6GGGsGGGqGGGsGGGIGGGsGGGpGGGsGGGiJJyC:QtuguyXzmUy+DZ1vftM8AkpZi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2740	2732	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2740	2732	2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2740	2732	2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2740	2732	2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2740	2732	2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e7e9626c5bf7a7d9414e99cdf6e6ff9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 120
  2⤵
  - Program crash
  PID:2740

memory/2732-0-0x00000000001C0000-0x00000000002B9000-memory.dmp

Filesize
996KB

Download